Method and apparatus for identifying wallets associated with virtual asset service providers

ABSTRACT

A method for identifying a wallet address associated with a virtual asset service provider is provided. The method comprises receiving a target wallet address, obtaining a transaction of a virtual asset associated with the target wallet address, obtaining a list of a plurality of known wallet addresses of virtual asset service providers (VASPs) and identifying a type of the target wallet address, by performing at least one of a cold wallet determination routine and a hot wallet determination routine for the target wallet address, based on the transaction and the list of known wallet addresses of the VASPs.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a Continuation Application of U.S. patentapplication Ser. No. 17/503,135, filed on Oct. 15, 2021, which claimsthe benefit of Korean Patent Application No. 10-2020-0180844, filed onDec. 22, 2020, in the Korean Intellectual Property Office, thedisclosure of which is incorporated herein by reference in its entirety.

BACKGROUND 1. Field

The present disclosure relates to a method and apparatus for identifyinga wallet address of a virtual asset service provider or a virtual assetexchange. More specifically, the present disclosure relates to a methodand apparatus for identifying a virtual asset service providerassociated with any virtual asset wallet address, and identifying a typeof a wallet associated with the virtual asset service provider.

2. Description of the Related Art

The dark web refers to the web part of the dark net, which is an overlaynetwork that can be accessed only with specific software or networkpermissions or settings that use non-standard communication protocolsand ports. Dark web user's ID and location are kept anonymous, they aredifficult to track due to layered encryption system, and dark webencryption technology routes user's data through multiple intermediateservers to protect user's identity and ensure anonymity. The informationtransmitted from the dark web can be decrypted only by the subsequentnode of the scheme, which leads to the end node. Due to the complexsystem of the dark web, it is difficult to reproduce the node path anddecode the information layer by layer. Further, due to the high level ofencryption, it is difficult for a web host on the dark web to track theuser's geographic location and IP, and on the contrary, it is difficultfor the user to obtain information about the host.

Virtual assets are digital assets created using cryptographictechnology, and virtual assets are used in the form of encrypted data ina network-connected Internet space. Most virtual assets store andtransmit value using decentralized blockchain technology, and use anencryption technology called hash to ensure the reliability and safetyof transactions without a central bank that guarantees value.

Recently, cybercrimes such as the concealment and laundry of criminalfunds using the dark web and virtual assets, etc. are increasingrapidly, and the level of crime is increasing. Further, existing crimessuch as distribution of drugs and pornography and concealment ofcriminal funds are developing into cybercrimes using the dark web andvirtual assets. For example, the number of global users reached 2.9million in 2019. Further, as of 2017, cybercrime-related sites accountedfor more than half of the total dark web. In addition, as virtual assetsthat are difficult to track are used for cybercrimes, economic andsocial damages are increasing rapidly. In 2019, the global virtual assetcrime loss amounted to 45.2 billion, which is 1.6 times higher than theprevious year, and the amount of virtual asset transaction on the darkweb in 2019 reached 12.5 million, which is 1.5 times higher than theprevious year.

As cybercrimes using the dark web and virtual assets are exploding andthe level of crime is gradually increasing, there is an evaluation thatthe technology to track them is still at a weak level. Both the dark weband virtual assets provide strong anonymity, so analyzing and trackingcrimes using them is a difficult technical task. In particular, sincecrimes through the dark web and virtual assets are closely related toreal life, technologies for analyzing and tracking cybercrimes using thedark web and virtual assets are strongly required.

In particular, identification of virtual asset service provider (VASP)by transaction stage for tracking virtual assets used in crime,collection and identification of virtual asset service provider walletaddresses, and classification technology through analysis and learningof transaction characteristics by VASP service type are essential.

SUMMARY

The technical problem to be solved through some embodiments of thepresent disclosure is to provide a method and apparatus for identifyinga wallet address of a virtual asset exchange (service provider) tradedon the dark web.

Another technical problem to be solved through some embodiments of thepresent disclosure is to provide a method and apparatus for identifyinga virtual asset service provider associated with any virtual assetwallet address, and identifying the type of a wallet associated with thevirtual asset service provider.

Another technical problem to be solved through some embodiments of thepresent disclosure is to provide a method and apparatus for identifyingwhether any virtual asset wallet address is a cold wallet address of avirtual asset service provider.

Another technical problem to be solved through some embodiments of thepresent disclosure is to provide a method and apparatus for identifyingwhether any virtual asset wallet address is a hot wallet address of avirtual asset service provider.

Another technical problem to be solved through some embodiments of thepresent disclosure is to provide a method and apparatus for identifyingwhether any virtual asset wallet address is a personal wallet addressissued by a virtual asset service provider.

The technical problems of the present disclosure are not limited to thetechnical problems mentioned above, and other technical problems thatare not mentioned will be clearly understood by those skilled in the artfrom the following description.

According to a method for identifying a wallet address associated with avirtual asset service provider performed on a computing devicecomprising, receiving a target wallet address, obtaining a transactionof a virtual asset associated with the target wallet address, obtaininga list of a plurality of known wallet addresses of virtual asset serviceproviders (VASPs) and identifying a type of the target wallet address,by performing at least one of a cold wallet determination routine and ahot wallet determination routine for the target wallet address, based onthe transaction and the list of known wallet addresses of the VASPs.

According to an embodiment, wherein the cold wallet determinationroutine, based on a determination that the only sender addressassociated with the transaction is the target wallet address, a receiveraddress associated with the transaction includes a hot wallet address ofa first VASP, and the transaction satisfies a first condition,determines that the target wallet address is a cold wallet address ofthe first VASP, wherein the hot wallet address of the first VASP is oneof the plurality of known wallet addresses of the VASPs.

According to an embodiment, wherein the target wallet address is awallet address for a transaction of Bitcoin, wherein the first conditionis that a value of a virtual asset associated with the transactioncorresponds to 100 BTC.

According to an embodiment, wherein the target wallet address is awallet address for a transaction of Ethereum, wherein the firstcondition is that a value of a virtual asset associated with thetransaction is 500 ETH or more, and a balance stored in the targetwallet address after the transaction exceeds 0 ETH.

According to an embodiment, wherein the hot wallet determinationroutine, based on a determination that a sender address associated withthe transaction includes both the target wallet address and a first hotwallet address of a second VASP, determines that the target walletaddress is a second hot wallet address of the second VASP, which isdistinguished from the first hot wallet address of the second VASP,wherein the first hot wallet address of the second VASP is one of theplurality of known wallet addresses of the VASPs.

According to an embodiment, wherein identifying a type of the targetwallet address by performing at least one of the cold walletdetermination routine and the hot wallet determination routine furthercomprises performing a personal wallet determination routine, whereinthe personal wallet determination routine, based on a determination thata sender address associated with the transaction includes the targetwallet address, the only receiver address associated with thetransaction is a hot wallet address of a third VASP, and a balancestored in the target wallet address after the transaction satisfies asecond condition, determines that the target wallet address is one ofpersonal wallet addresses associated with the third VASP, wherein thehot wallet address of the third VASP is one of the plurality of knownwallet addresses of the VASPs.

According to an embodiment, wherein the personal wallet determinationroutine, based on a determination that the balance stored in the targetwallet address after the transaction does not satisfy the secondcondition, determines that the target wallet address is one of otherwallet addresses associated with the third VASP.

According to an embodiment, wherein the second condition is that thebalance stored in the target wallet address after the transaction is0.00005000 BTC or less.

According to an embodiment, wherein the hot wallet determinationroutine, based on a determination that a sender address associated withthe transaction is a cold wallet address of a second VASP, determinesthe target wallet address is a hot wallet address of the second VASP,wherein the cold wallet address of the second VASP is one of theplurality of known wallet addresses of the VASPs.

According to an embodiment, wherein identifying a type of the targetwallet address by performing at least one of the cold walletdetermination routine and the hot wallet determination routine furthercomprises performing a personal wallet determination routine, whereinthe personal wallet determination routine, based on a determination thata sender address associated with the transaction is the target walletaddress, the only receiver address associated with the transaction is ahot wallet address of a third VASP, and a balance stored in the targetwallet address after the transaction satisfies a second condition,determines that the target wallet address is one of personal walletaddresses associated with the third VASP, wherein the hot wallet addressof the third VASP is one of the plurality of known wallet addresses ofthe VASPs.

According to an embodiment, wherein the personal wallet determinationroutine, based on a determination that the balance stored in the targetwallet address after the transaction does not satisfy the secondcondition, determines that the target wallet address is one of otherwallet addresses associated with the third VASP.

According to an embodiment, wherein the second condition is that thebalance stored in the target wallet address after the transaction is 0ETH.

According to an embodiment, the plurality of known wallet addresses ofthe VASPs are collected and stored in advance.

According to another aspect of the present disclosure an apparatus foridentifying a wallet address associated with a virtual asset serviceprovider comprising, a VASPs information management unit, a transactioninformation management unit and a wallet address determination unit,wherein the VASPs information management unit manages information on aknown wallet address of a VASPs and types, wherein the transactioninformation management unit collects and manages transactions related tothe virtual asset from an external virtual asset trading network,wherein the wallet address determination unit, if the target walletaddress is not stored in the VASPs information management unit, obtainsa virtual asset transaction associated with the target wallet addressfrom the transaction information management unit, obtains a list of theknown wallet addresses of the VASPs from the VASPs informationmanagement unit, and identifies a type of the target wallet address byperforming at least one of a plurality of wallet address determinationroutines for the target wallet address based on the transaction and thelist of known wallet addresses of the VASPs.

According to another aspect of the present disclosure a computerreadable non-transitory storage medium comprising an instruction,wherein the instruction is executable by a processor to cause theprocessor to perform steps comprising, receiving a target walletaddress, obtaining a transaction of a virtual asset associated with thetarget wallet address, obtaining a list of a plurality of known walletaddresses of virtual asset service providers (VASPs) and identifying atype of the target wallet address, by performing at least one of a coldwallet determination routine and a hot wallet determination routine forthe target wallet address, based on the transaction and the list ofknown wallet addresses of the VASPs.

BRIEF DESCRIPTION OF THE DRAWINGS

These and/or other aspects will become apparent and more readilyappreciated from the following description of the embodiments, taken inconjunction with the accompanying drawings in which:

FIG. 1 is a diagram illustrating a device for identifying a walletaddress of a virtual asset service provider according to an embodimentdisclosed in the present description;

FIG. 2 is a flowchart of a method of identifying a wallet address for avirtual asset service provider according to another embodiment disclosedin the present description;

FIG. 3 is a diagram for describing virtual asset transaction informationreferred to in some embodiments disclosed in the present description;

FIG. 4 is a diagram for describing wallet information referred to insome embodiments disclosed in the present description;

FIG. 5 is a diagram for describing in more detail some steps of themethod described with reference to FIG. 2 ;

FIGS. 6 and 7 are diagrams for describing transaction patterns for eachwallet type, which may be referred to in some embodiments disclosed inthe present description;

FIG. 8 is a block diagram of a device for identifying a wallet addressof a virtual asset service provider described with reference to FIG. 1 ;

FIG. 9 is a diagram for describing the function and configuration of thetransaction information management unit described with reference to FIG.8 ;

FIG. 10 is a view for describing the function and configuration of theVASP information management unit described with reference to FIG. 8 ;and

FIG. 11 is a diagram for describing an exemplary computing devicecapable of implementing a virtual asset service provider wallet addressidentification device according to some embodiments disclosed in thepresent description.

DETAILED DESCRIPTION

Hereinafter, preferred embodiments of the present disclosure will bedescribed with reference to the attached drawings. Advantages andfeatures of the present disclosure and methods of accomplishing the samemay be understood more readily by reference to the following detaileddescription of preferred embodiments and the accompanying drawings. Thepresent disclosure may, however, be embodied in many different forms andshould not be construed as being limited to the embodiments set forthherein. Rather, these embodiments are provided so that this disclosurewill be thorough and complete and will fully convey the concept of thedisclosure to those skilled in the art, and the present disclosure willonly be defined by the appended claims.

In adding reference numerals to the components of each drawing, itshould be noted that the same reference numerals are assigned to thesame components as much as possible even though they are shown indifferent drawings. In addition, in describing the present inventiveconcept, when it is determined that the detailed description of therelated well-known configuration or function may obscure the gist of thepresent inventive concept, the detailed description thereof will beomitted.

Unless otherwise defined, all terms used in the present specification(including technical and scientific terms) may be used in a sense thatcan be commonly understood by those skilled in the art. In addition, theterms defined in the commonly used dictionaries are not ideally orexcessively interpreted unless they are specifically defined clearly.The terminology used herein is for the purpose of describing particularembodiments only and is not intended to be limiting of the invention. Inthis specification, the singular also includes the plural unlessspecifically stated otherwise in the phrase.

In addition, in describing the component of this invention, terms, suchas first, second, A, B, (a), (b), can be used. These terms are only fordistinguishing the components from other components, and the nature ororder of the components is not limited by the terms. If a component isdescribed as being “connected,” “coupled” or “contacted” to anothercomponent, that component may be directly connected to or contacted withthat other component, but it should be understood that another componentalso may be “connected,” “coupled” or “contacted” between eachcomponent.

Hereinafter, some embodiments of the present inventive concept will bedescribed in detail with reference to the accompanying drawings.

FIG. 1 is a diagram illustrating a device for identifying a walletaddress of a virtual asset service provider according to an embodimentdisclosed in the present specification.

Referring to FIG. 1 , the virtual asset service provider wallet addressidentification device 1 according to the present embodiment may receivean inquiry target wallet address from the wallet address inquiry device2, identify the type of the inquiry target wallet address, and providethe wallet address inquiry result.

In this description, a virtual asset service provider (VASP) refers to acompany that provides related services, such as an exchange of virtualassets such as Bitcoin and Ethereum, but is not limited to these typesof virtual assets, and may refer to a variety of intangible assetsprovided by a virtual asset service provider.

The inquiry target wallet address is the address of the virtual assetwallet input to the wallet address inquiry device 2, and is a walletaddress whose type is not identified. Here, the type refers to whichwallet among a hot wallet, a cold wallet, a personal wallet, or otherwallet corresponds to the virtual asset wallet.

The wallet address inquiry device 2 is a device that can requestidentification of a wallet address such as a computer, laptop,smartphone, etc., and means various devices that can receive the inquirytarget wallet address and transmit the input address to a virtual assetwallet address identification device 1 (hereinafter, referred as VASPwallet address identification device). Meanwhile, in FIG. 1 , the walletaddress inquiry device 2 is divided into a device separate from the VASPwallet address identification device 1, but in actual implementation,the wallet address inquiry device 2 and the VASP wallet addressidentification device 1 may be implemented as a single device. In thiscase, the VASP wallet address identification device 1 may perform bothan operation of inputting an inquiry target wallet address and anoperation of outputting a result of inquiring the wallet address.

Hereinafter, a specific operation of the VASP wallet addressidentification device 1 identifying a type of an inquiry target walletaddress and providing a wallet address inquiry result will be described.Specifically, the VASP wallet address identification device 1 mayreceive an inquiry target wallet address from the wallet address inquirydevice 2. Thereafter, the VASP wallet address identification device 1may obtain a virtual asset transaction associated with the inquirytarget wallet address. The virtual asset transaction associated with theinquiry target wallet address may mean information on the transaction ofthe virtual asset, and may be obtained from an external network. Forexample, the VASP wallet address identification device 1 may obtain avirtual asset transaction associated with the inquiry target walletaddress from an external Bitcoin trading network or an external Ethereumtrading network.

The VASP wallet address identification device 1 may obtain a list of aplurality of known virtual asset service provider (VASP) walletaddresses. The list of a plurality of known virtual asset serviceprovider wallet addresses is information collected and stored inadvance, and refers to a previously identified type of virtual assetservice provider wallet address. The list of a plurality of knownvirtual asset service provider wallet addresses may refer to informationstored in a database.

The VASP wallet address identification device 1 may identify a type ofthe inquiry target wallet address by performing at least one of a coldwallet determination routine and a hot wallet determination routine forthe inquiry target wallet address based on the transaction and the listof known VASP wallet addresses. Here, the cold wallet determinationroutine refers to an operation of determining whether the inquiry targetwallet address is a cold wallet, and the hot wallet determinationroutine refers to an operation of determining whether the inquiry targetwallet address is a hot wallet. Meanwhile, the determination routine mayrefer to an algorithm for determining which virtual asset type is thetype of the corresponding wallet address, and the name may refer to anoperation of identifying the type of the inquiry target wallet address,such as a clustering routine and a clustering algorithm. It is notlimited to the dictionary meaning of the name.

So far, the VASP wallet address identification device 1 of the presentdisclosure has been schematically described with reference to FIG. 1 .Hereinafter, a method of identifying a wallet address associated with avirtual asset service provider will be described with reference to FIGS.2 to 9 . This embodiment may be performed by a computing device. Forexample, the computing device may be a VASP wallet addressidentification device. In describing the present embodiment, descriptionof a subject performing some operations may be omitted. In this case,the performing subject is the computing device.

FIG. 2 is a flowchart of a method of identifying a wallet address of avirtual asset service provider according to another embodiment disclosedin the present description.

First, in step S100 of FIG. 2 , an inquiry target wallet address may beinput. At this time, the inquiry target wallet address may be an addresscomposed of uppercase and lowercase letters and numbers, such as“1KnnYJx3k6iyzAeTDHKNvL12haFCMUBdPc.” In this step, the type of thevirtual asset is not input, but only the wallet address seeking inquirymay be input.

Thereafter, in step S200, a virtual asset transaction associated withthe inquiry target wallet address may be obtained. The virtual assettransaction may be collected through an external network, andinformation as shown in FIG. 3 may be obtained by collecting all data ofall blocks and transactions from the initial block to the last block ofthe virtual asset.

Referring to Table 11 of FIG. 3 , for example, a transaction of Bitcoinmay include fields such as input address, output address, transactionasset value and time, and the like. In the transaction of Bitcoin, theinput address of ID 1 is “36718cp5ktBy . . . ,” the output addresses are“3P7Dbq93T8 . . . ” and “13BKpMKWUW . . . ,” the transaction asset valueis “0.00014093 BTC,” and the timestamp value of the transaction timerepresents “1608012178.”

In the transaction of Bitcoin, the input addresses of ID 2 are“399LhavcqSvq . . . ” and “13BKpMKWUWQ . . . ,” the output address is“1igV5Xev5f . . . ,” the transaction asset value is “6.61782071 BTC,”and the timestamp value of the transaction time represents “1608012345.”

Referring to Table 12 of FIG. 3 , the transaction of Ethereum mayinclude fields such as a sender address, a receiver address, atransaction asset value and time, and the like. In the transaction ofEthereum, the sender address of ID 1 is “56fd33b37b28 . . . ,” thereceiver address is “1c5b662a08d40 . . . ,” the transaction asset valueis “0.611428114562323488 ETH,” and the timestamp value of thetransaction time represents “1608012178.”

In the transaction of Ethereum, the sender address of ID 2 is“DA8646D996058,” the output address is “Eaee3a142ac4e0 . . . ,” thetransaction asset value is “0.163818897637795252 ETH,” and the timestampvalue of the transaction time represents “1608012345.”

Returning back to FIG. 2 , in step S300, a list of a plurality of knownvirtual asset service provider (VASP) wallet addresses may be obtained.A list of a plurality of known virtual asset service provider walletaddresses may be stored and managed in a database, and in this case, alist of a plurality of known virtual asset service provider walletaddresses may be managed through a RDB (Relational Database). A list ofa plurality of known virtual asset service provider wallet addresses maybe stored in the form as shown in FIG. 4 .

Referring to FIG. 4 , a list of a plurality of known virtual assetservice provider wallet addresses may include fields such as a walletaddress, a virtual asset type, a related VASP, a wallet type, aninformation source, and a related fraudulent transaction type. Althoughnot shown, information on virtual asset service providers can also bemanaged through a database. Information on the virtual asset serviceprovider may include, for example, service provider name, serviceprovider code or common name, first business day, business end date,representative name, address, and business type (exchange, P2P, walletprovider). Further, the database may include the initial VASP creationdate, the most recent use date, the collection date and time, and thecollection place. The database can be stored by classifying the types offraudulent transactions into “none, investment fraud, malicious code,illegal transactions, money laundering, and hacking of exchanges.”

For example, in the list of a plurality of known virtual asset serviceprovider wallet addresses, ID 1 may have the wallet address of“56fd33b37b28 . . . ,” the virtual asset type of “ETH,” the associatedVASP of “VASP #48,” and the wallet type of “hot wallet.” ID 2 may havethe wallet address of “Eaee3a142ac4e0 . . . ,” the virtual asset type of“ETH,” the associated VASP of “VASP #48,” and the wallet type of “coldwallet.” ID 3 may have the wallet address of “399LhavcSvqRA8i . . . ,”the virtual asset type of “BTC,” the associated VASP of “VASP #2,” andthe wallet type of “personal wallet.”

Referring back to FIG. 2 , S400 is performed to perform at least one ofa cold wallet determination routine and a hot wallet determinationroutine, so that the type of the inquiry target wallet address may beidentified. In this step, a determination routine may be performed forthe inquiry target wallet address based on a transaction and a list ofknown VASP wallet addresses. Thereafter, the wallet type and associatedVASP information identified as a result of performing the routine ofdetermining the wallet address may be stored in step S500.

The various embodiments of the determination routine will be describedwith reference to FIG. 5 . FIG. 5 is a view for describing in moredetail some steps of the method described with reference to FIG. 2 .

When step S400 is performed, at least some of steps S410 to S450 may beperformed. In FIG. 5 , steps S420 to S450 are shown to be sequentiallyperformed, but this is for illustrative purposes only, and the order ofoperations of steps S420 to S450 is not limited to the order shown inFIG. 5 . For example, steps S420 to S450 may be performed together atthe same time, or may be performed in an arbitrary order different fromthat shown.

Hereinafter, steps S410 to S450 will be described in detail.

First, in step S410, the type of the virtual asset may be identifiedthrough the transaction of the inquiry target wallet address. The typeof virtual asset at this stage means the type of virtual asset. Forexample, the type of virtual asset in step S410 means whether thevirtual asset is Bitcoin or Ethereum, etc. In this step, it can beidentified whether the address of the inquiry target wallet is used forBitcoin or Ethereum through a transaction. Since different transactionpatterns are generated according to the type of asset (such as Bitcoinor Ethereum), different determination routines may be performedaccording to the type of the virtual asset in steps S420 to 450.

On the other hand, before or after step S410 is performed or at the sametime, it is searched to check if information on the virtual asset type(hot wallet, cold wallet, personal wallet, or other wallet)corresponding to the inquiry target wallet address exists in thedatabase, and then if the corresponding information exists in thedatabase, the type of the inquiry target wallet address is identifiedusing the corresponding information, and step S400 may be terminated.

However, if the inquiry target wallet address is not stored in the listof known VASP wallet addresses, the wallet determination routine ofsteps S420 to S450 may be performed. An example of steps S420 to S450will be described with reference to FIGS. 5 and 6 together.

FIGS. 6 and 7 are diagrams for describing transaction patterns for eachwallet type, which may be referred to in some embodiments disclosed inthe present description. The determination routines of steps S420 toS450 may be understood as routines that determine whether thetransaction involving the inquiry target wallet address matches anexemplary cold wallet transaction pattern, a hot wallet transactionpattern, a personal wallet transaction pattern, or other wallettransaction pattern shown in FIGS. 6 and 7 . It will be described indetail below.

FIG. 6 shows examples of transaction patterns for various types ofwallets of Bitcoin. Hereinafter, the transaction pattern of Bitcoin willbe described in the order of a cold wallet transaction pattern, a hotwallet transaction pattern, a personal wallet transaction pattern, andother wallet transaction patterns.

First, the cold wallet determination routine may determine whether atransaction involving an inquiry target wallet address matches a coldwallet transaction pattern. Specifically, when the only sender addressof the transaction is the inquiry target wallet address, the receiveraddress of the transaction is a hot wallet address of a known VASP, and100 BTC is remitted from the inquiry target wallet address to the hotwallet address of the known VASP by the transaction, it may bedetermined that it matches the cold wallet transaction pattern. In thiscase, the inquiry target wallet address may be determined as the coldwallet address of the VASP. At this time, the 100 BTC is an example andmay be changed to a larger or smaller asset value.

Next, the hot wallet determination routine may determine whether atransaction involving the inquiry target wallet address matches the hotwallet transaction pattern. Specifically, when an inquiry target walletaddress and a known VASP hot wallet address exist in the same inputaddress of a transaction, it may be determined that the inquiry targetwallet address matches the hot wallet transaction pattern. In this case,it may be determined that the inquiry target wallet address is the hotwallet address of the VASP.

Next, the personal wallet determination routine may determine whetherthe transaction involving the inquiry target wallet address matches thepersonal wallet transaction pattern. Specifically, if there is only oneknown VASP hot wallet address in the output address of the transaction,there are multiple addresses in the input address of the transaction,and the final balance of the inquiry target wallet after the transactionis 0.00005000 BTC or less, it may be determined that the inquiry targetwallet address matches the personal wallet transaction pattern. In thiscase, the inquiry target wallet address may be determined as thepersonal wallet address of the VASP. At this time, 0.00005000 BTC is anexample and may be changed to a larger or smaller asset value.

Next, the other wallet determination routine may determine whether thetransaction involving the inquiry target wallet address matches theother wallet transaction pattern. Specifically, if there is only oneknown VASP hot wallet address in the output address of the transaction,there are multiple addresses in the input address of the transaction,and the final balance of the inquiry target wallet after the transactionexceeds 0.00005000 BTC, it may be determined that the inquiry targetwallet address matched the personal wallet transaction pattern. In thiscase, the inquiry target wallet address may be determined as the otherwallet address of the VASP. At this time, 0.00005000 BTC is an exampleand may be changed to a larger or smaller asset value.

So far, examples of various transaction patterns for various wallets ofBitcoin have been described with reference to FIG. 6 .

Next, FIG. 7 shows examples of various transaction patterns for variouswallets of Ethereum. Hereinafter, the transaction pattern of Ethereumwill be described in the order of a cold wallet transaction pattern, ahot wallet transaction pattern, a personal wallet transaction pattern,and other wallet transaction patterns.

First, the cold wallet determination routine may determine whether atransaction involving an inquiry target wallet address matches a coldwallet transaction pattern. Specifically, if there is the inquiry targetwallet address in the sender address of the transaction, there is theknown VASP hot wallet address in the receiver address, and the remittedvirtual asset is 500 ETH or more, it may be determined to match the coldwallet transaction pattern. In this case, the inquiry target walletaddress may be determined as the cold wallet address of the VASP. Inthis case, the 500 ETH is an example and may be changed to a lager orsmaller asset value.

Next, the hot wallet determination routine may determine whether atransaction involving the inquiry target wallet address matches the hotwallet transaction pattern. Specifically, if there is a known VASP hotwallet address in the sender address of the transaction, and there isthe inquiry target wallet in the receiver address, it may be determinedthat the inquiry target wallet address matches the hot wallettransaction pattern. In this case, the inquiry target wallet address maybe determined as the cold wallet address of the VASP.

Next, the personal wallet determination routine may determine whetherthe transaction involving the inquiry target wallet address matches thepersonal wallet transaction pattern. Specifically, if there is theinquiry target wallet address in the sender address of the transaction,there is the known VASP hot wallet address in the receiver address, thetransactional virtual asset value occurred in the transaction is lessthan 500 ETH, and the final balance of the inquiry target wallet afterthe transaction is 0 ETH, it may be determined that the inquiry targetwallet address matches the personal wallet transaction pattern. In thiscase, the inquiry target wallet address may be determined as thepersonal wallet address of the VASP. At this time, 0 ETH is an exampleand may be changed to a larger or smaller asset value.

Next, the other wallet determination routine may determine whether thetransaction involving the inquiry target wallet address matches theother wallet transaction pattern. Specifically, if there is the inquirytarget wallet address in the sender address of the transaction, there isthe known VASP hot wallet address in the receiver address, thetransactional virtual asset value occurred in the transaction is lessthan 500 ETH, and the final valance of the inquiry target wallet afterthe transaction is 0 ETH or more, it may be determined that the inquirytarget wallet address matches the other wallet transaction pattern. Inthis case, the inquiry target wallet address may be determined as theother wallet address of the VASP. At this time, 0 ETH is an example andmay be changed to a larger or smaller asset value.

So far, a method of identifying a wallet address associated with avirtual asset service provider disclosed in the present description hasbeen described with reference to FIGS. 1 to 7 . In the method ofidentifying a wallet address associated with a virtual asset serviceprovider according to some embodiments of the present disclosure, thereis an advantage of being able to identify more accurately the type ofwallet such as a cold wallet, a hot wallet, a personal wallet, and otherwallets in addition to the information on which virtual asset serviceprovider the inquiry target wallet address is associated with.

Hereinafter, a specific configuration and operation of the virtual assetservice provider wallet address identification device 1 will bedescribed with reference to FIGS. 8 to 10 . In this case, thedescription described above with reference to FIGS. 2 to 7 may bereferred to.

FIG. 8 is a block diagram of the virtual asset service provider walletaddress identification device 1 described with reference to FIG. 1 .

Referring to FIG. 8 , the virtual asset service provider wallet addressidentification device 1 may include an inquiry interface unit 10, awallet address determination unit 20, a transaction informationmanagement unit 30, and a VASP information management unit 40.

The inquiry interface unit 10 may receive the address of the inquirytarget wallet obtained from the wallet address inquiry device 2. Thewallet address determination unit 20 may identify the type of theinquiry target wallet address based on information stored in thetransaction information management unit 30 and the VASP informationmanagement unit 40.

The transaction information management unit 30 may collect transactionsfrom a virtual asset trading network implemented as an external network.The transaction information management unit 30 may collect transactionsfor Bitcoin from the Bitcoin trading network 5 and may collecttransactions for Ethereum from the Ethereum trading network 6. Thetransaction information management unit 30 may collect transactions fromvarious external networks capable of collecting transactions in additionto the above-described external networks.

If the inquiry target wallet address is stored in the VASP informationmanagement unit 40, the wallet address determination unit 20 may use theinformation to identify the type of the inquiry target wallet address.

If the inquiry target wallet address is not stored in the VASPinformation management unit 40, the wallet address determination unit 20may obtain a virtual asset transaction associated with the inquirytarget wallet address from the transaction information management unit30, and obtain the list of known VASP wallet addresses from the VASPinformation management unit 40.

In this case, the wallet address determination unit 20 performs at leastone of a plurality of wallet address determination routines for theinquiry target wallet address based on the transaction and the list ofknown VASP wallet addresses to identify the type of the inquiry targetwallet address.

FIG. 9 is a diagram for describing the function and configuration of thetransaction information management unit 30 described with reference toFIG. 8 .

The transaction information management unit 30 may collect transactionsfrom a virtual asset trading network implemented as an external networkby using the transaction information collection unit. The transactioninformation collection unit may store transactions from the Bitcointrading network 5 and the Ethereum trading network 6, respectively, andstore them in the transaction DB.

FIG. 10 is a diagram for describing the function and configuration ofthe VASP information management unit 40 described with reference to FIG.8 .

The VASP information management unit 40 may store, manage, or updateinformation in the wallet information DB 42 and the service providerinformation DB 43 using the VASP information collection unit 41. TheVASP information management unit 40 may manage information on a knownVASP wallet address and type by using the VASP information collectionunit 41. The VASP information collection unit 41 may load informationfrom the wallet information DB 42 and provide information on a knownVASP wallet address and type to the wallet address determination unit20. The VASP information collection unit 41 may add information on thenew VASP wallet address and type to the wallet information DB 42 and theservice provider information DB 43, or newly update informationpreviously existing in the wallet information DB 42 and the serviceprovider information DB 43 based on the result determined by the walletaddress determination unit 20.

The wallet address determination unit 20 may identify the type of theinquiry target wallet address by using the above-described transactioninformation and information on the known VASP wallet address and type.

Hereinafter, a routine, in which the wallet address determination unit20 identifies the type of the inquiry target wallet address in theBitcoin transaction pattern in the order of a cold wallet transactionpattern, a hot wallet transaction pattern, a personal wallet transactionpattern, and other wallet transaction patterns, will be described.

First, the cold wallet determination routine corresponds to a case wherethe only sender address of the transaction is the inquiry target walletaddress, and the receiver address of the transaction is the hot walletaddress of the first VASP.

The wallet address determination unit 20 may determine that the inquirytarget wallet address is the cold wallet address of the first VASP basedon the determination that the transaction satisfies the first conditionin this routine. In this case, the hot wallet address of the first VASPmay be determined as one of a plurality of known VASP wallet addresses.

In this embodiment, the inquiry target wallet address may be a walletaddress for transactions of Bitcoin. The first condition may be acondition, in which the value of the virtual asset traded by thetransaction corresponds to 100 BTC.

That is, if the inquiry target wallet address is input and there is atransaction indicating that 100 BTC has been remitted from the inquirytarget wallet to the hot wallet of the first VASP, the wallet addressdetermination unit 20 may determine that the inquiry target wallet isthe cold wallet of the first VASP.

Based on the determination that the sender address of the transactionincludes both the inquiry target wallet address and the first hot walletaddress of the second VASP, the hot wallet determination routinedetermines that the inquiry target wallet address is the second hotwallet address of the second VASP, which is distinguished from the firsthot wallet address of the second VASP. In this case, the first hotwallet address of the second VASP is one of a plurality of known VASPwallet addresses.

That is, if the inquiry target wallet address is input and there is atransaction indicating that remittance from the inquiry target walletand the first hot wallet known as the second VASP to a wallet of anytype exists, the wallet address determination unit 20 may determine thatthe inquiry target wallet is the second hot wallet address of the secondVASP.

In the personal wallet determination routine, the sender address of thetransaction may include the inquiry target wallet address, and the onlyreceiver address of the transaction may be the hot wallet address of thethird VASP. At this time, based on the determination that the balancestored in the inquiry target wallet address after the transactionsatisfies the second condition, the wallet address determination unit 20may determine that the inquiry target wallet address is one of thepersonal wallet addresses associated with the third VASP. Here, thesecond condition may be a condition, in which the balance stored in theinquiry target wallet address after the transaction is 0.00005000 BTC orless. The hot wallet address of the third VASP may be one of a pluralityof known VASP wallet addresses.

That is, if the inquiry target wallet is input, a transaction indicatingthat the virtual asset has been remitted from the wallet of any typetogether with the inquiry target wallet to the hot wallet of the thirdVASP occurs, and then the balance in the inquiry target wallet is0.00005000 BTC or less, the wallet address determination unit 20 maydetermine that the inquiry target wallet is a personal wallet associatedwith the third VASP.

The other wallet determination routine may determine that the inquirytarget wallet address is one of the other wallet addresses associatedwith the third VASP based on the determination that the balance storedin the inquiry target wallet address after the transaction does notsatisfy the second condition in the personal wallet determinationroutine. That is, when the balance stored in the inquiry target walletaddress is greater than 0.00005000 BTC, the wallet address determinationunit 20 may determine that the inquiry target wallet address is one ofother wallet addresses associated with the third VASP.

That is, if the inquiry target wallet is input, a transaction indicatingthat the virtual asset has been remitted from the wallet of any typetogether with the inquiry target wallet to the hot wallet of the thirdVASP occurs, and then the balance in the inquiry target wallets isgreater than 0.00005000 BTC, the wallet address determination unit 20may determine that the inquiry target wallet is other wallet associatedwith the third VASP.

So far, the examples of various transaction patterns for various walletsof Bitcoin have been described.

Hereinafter, the transaction pattern of Ethereum will be described inthe order of a cold wallet transaction pattern, a hot wallet transactionpattern, a personal wallet transaction pattern, and other wallettransaction patterns.

First, the cold wallet determination routine corresponds to a case wherethe only sender address of the transaction is the inquiry target walletaddress, and the receiver address of the transaction is the hot walletaddress of the first VASP.

The wallet address determination unit 20 may determine that the inquirytarget wallet address is the cold wallet address of the first VASP basedon the determination that the transaction satisfies the first conditionin this routine. In this case, the hot wallet address of the first VASPmay be one of a plurality of known VASP wallet addresses.

In this embodiment, the inquiry target wallet address may be a walletaddress for transactions of Ethereum. The first condition may be acondition, in which the value of the virtual asset traded by thetransaction is 500 ETH or more, and the balance stored in the inquirytarget wallet address after the transaction exceeds 0 ETH.

That is, if the inquiry target wallet address is input, a transactionindicating that the value of the virtual asset traded from the inquirytarget wallet to a wallet known as the hot wallet of the first VASP is500 ETH or more occurs, and the balance stored in the inquiry targetwallet address after the transaction exceeds 0 ETH, the wallet addressdetermination unit 20 may determine that the inquiry target wallet is acold wallet of the first VASP.

The hot wallet determination routine may determine that the inquirytarget wallet address is the hot wallet address of the second VASP basedon a determination that the sender address of the transaction is thecold wallet address of the second VASP. In this case, the cold walletaddress of the second VASP may be one of the plurality of known VASPwallet addresses.

That is, if an inquiry target wallet address is input and a transactionindicating that the inquiry target wallet receives a virtual asset fromthe cold wallet of the known second VASP occurs, the wallet addressdetermination unit 20 may determine that the inquiry target walletaddress is the hot address of the second VASP.

In the personal wallet determination routine, the sender address of thetransaction is the inquiry target wallet address, the only receiveraddress of the transaction is the hot wallet address of the third VASP,and the wallet address determination unit 20 may determine that theinquiry target wallet address is one of the personal wallet addressesassociated with the third VASP based on the determination that thebalance stored in the inquiry target wallet address after thetransaction satisfies the second condition. At this time, this should bethe case where the trading of the virtual asset in the occurredtransaction is less than 500 ETH. Here, the second condition may be acondition, in which the balance stored in the inquiry target walletaddress after the transaction is 0 ETH. The hot wallet address of thethird VASP may be one of the plurality of known VASP wallet addresses.

That is, if an inquiry target wallet is input, a transaction indicatingthat a virtual asset of less than 500 ETH has been remitted from theinquiry target wallet to the hot wallet of the third VASP occurs, andthen the balance stored in the wallet address of the inquiry targetwallet address is 0 ETH, the wallet address determination unit 20 maydetermine that the inquiry target wallet is a personal wallet associatedwith the third VASP.

In FIG. 7 , the other wallet determination routine may determine thatthe inquiry target wallet address is one of the other wallet addressesassociated with the third VASP based on the determination that thebalance stored in the inquiry target wallet address after thetransaction does not satisfy the second condition. At this time, thisshould be the case where the trading of the virtual asset in theoccurred transaction is less than 500 ETH. That is, if the balancestored in the inquiry target wallet address after the transaction isgreater than 0 ETH, the wallet address determination unit 20 maydetermine that the inquiry target wallet address is one of other walletaddresses associated with the third VASP.

That is, if the inquiry target wallet is input, a transaction indicatingthat a virtual asset of less than 500 ETH has been remitted from theinquiry target wallet to the hot wallet of the third VASP occurs, andthe balance stored in the wallet address of the inquiry target wallet isgreater than 0 ETH, the inquiry target wallet may be determined as apersonal wallet associated with the third VASP.

The specific configuration and function of the virtual asset serviceprovider wallet address identification device 1 has been described withreference to FIGS. 8 to 10 . FIG. 11 is an exemplary hardwareconfiguration diagram illustrating the computing device 500. Thecomputing device 500 of FIG. 11 may be the VASP wallet addressidentification device 1 of FIGS. 8 to 10 .

As shown in FIG. 11 , the computing device 500 may include one or moreprocessors 510, a bus 550, a communication interface 570, a memory 530,which loads a computer program 591 executed by the processors 510, and astorage 590 for storing the computer program 591. However, FIG. 11illustrates the components related to the embodiment of the presentdisclosure. Therefore, it will be appreciated by those skilled in theart that the present disclosure may further include other generalpurpose components in addition to the components shown in FIG. 11 .

The processor 510 may control overall operations of each component ofthe computing device 500. The processor 510 may be configured to includeat least one of a Central Processing Unit (CPU), a Micro Processor Unit(MPU), a Micro Controller Unit (MCU), a Graphics Processing Unit (GPU),or any type of processor well known in the art. Further, the processor510 may perform calculations on at least one application or program forexecuting a method/operation according to various embodiments of thepresent disclosure. The computing device 500 may have one or moreprocessors.

The memory 530 may store various data, instructions and/or information.The memory 530 may load one or more programs 591 from the storage 590 toexecute methods/operations according to various embodiments of thepresent disclosure. For example, based on the computer program 591 beingloaded into the memory 530, the logic as shown in FIG. 2 may beimplemented on the memory 530. An example of the memory 530 may be aRAM, but is not limited thereto.

The bus 550 may provide communication between components of thecomputing device 500. The bus 550 may be implemented as various types ofbus such as an address bus, a data bus and a control bus.

The communication interface 570 may support wired and wireless internetcommunication of the computing device 500. The communication interface570 may support various communication methods other than internetcommunication. To this end, the communication interface 570 may beconfigured to include a communication module based on hardware and/orsoftware well known in the art of the present disclosure.

The storage 590 can non-temporarily store one or more computer programs591. The storage 590 may be configured to include a non-volatile memory,such as a Read Only Memory (ROM), an Erasable Programmable ROM (EPROM),an Electrically Erasable Programmable ROM (EEPROM), a flash memory, ahard disk, a removable disk, or any type of computer readable recordingmedium well known in the art.

The computer program 591 may include one or more instructions, on whichthe methods/operations according to various embodiments of the presentdisclosure may be implemented. Based on the computer program 591 beingloaded on the memory 530, the processor 510 may perform themethods/operations in accordance with various embodiments of the presentdisclosure by executing the one or more instructions.

The technical features of the present disclosure described so far may beembodied as computer readable codes on a computer readable medium. Thecomputer readable medium may be, for example, a removable recordingmedium (CD, DVD, Blu-ray disc, USB storage device, removable hard disk)or a fixed recording medium (ROM, RAM, computer equipped hard disk). Thecomputer program recorded on the computer readable medium may betransmitted to another computing device via a network such as internetand installed in the other computing device, being used in the othercomputing device.

Although the operations may be shown in an order in the drawings, thoseskilled in the art will appreciate that many variations andmodifications can be made to the embodiments without substantiallydeparting from the principles of the present disclosure. The disclosedembodiments of the present disclosure may be used in a generic anddescriptive sense and not for purposes of limitation. The scope ofprotection of the present disclosure should be interpreted by thefollowing claims, and all technical ideas within the scope equivalentthereto should be construed as being included in the scope of thetechnical idea defined by the present disclosure.

What is claimed is:
 1. A method for identifying a wallet addressassociated with a virtual asset service provider performed on a walletaddress identification device having a hardware processor, the methodcomprising: obtaining, by a transaction information management unit, atransaction of a virtual asset corresponding to the target walletaddress; obtaining, by a wallet address identification device, a list ofa plurality of known wallet addresses of virtual asset service providers(VASPs); identifying, by the wallet address identification device, atype of the target wallet address based on the transaction and the listof known wallet addresses of the VASPs; transmitting, by the walletaddress identification device, to the wallet address inquiry device, thetype of the target wallet address and the associated VASP information;determining, by the wallet address identification device, that a walletinformation database or a service provider information database does nothave information on the target wallet address; and based on adetermination, by the wallet address identification device, that thewallet information database or the service provider information databasedoes not have the information on the target wallet address, adding theinformation on the target wallet address and the type of the targetwallet address to the wallet information database or the serviceprovider information database.
 2. The method of claim 1, wherein theobtaining a list of a plurality of known wallet addresses of virtualasset service providers (VASPs) comprises obtaining the list of aplurality of known wallet addresses of virtual asset service providers(VASPs) from a non-transitory memory database of the wallet addressidentification device, which collects and stores information regardingthe plurality of known wallet addresses of VASPs.
 3. The method of claim1, wherein the identifying comprises identifying the type of the targetwallet address, by performing at least one of a cold walletdetermination routine and a hot wallet determination routine for thetarget wallet address.
 4. The method of claim 3, wherein the cold walletdetermination routine, based on a determination that the only senderaddress associated with the transaction is the target wallet address, areceiver address associated with the transaction includes a hot walletaddress of a first VASP, and the transaction satisfies a firstcondition, determines that the target wallet address is a cold walletaddress of the first VASP.
 5. The method of claim 4, wherein the hotwallet address of the first VASP is one of the plurality of known walletaddresses of the VASPs.
 6. The method of claim 3, wherein the hot walletdetermination routine, based on a determination that a sender addressassociated with the transaction includes both the target wallet addressand a first hot wallet address of a second VASP, determines that thetarget wallet address is a second hot wallet address of the second VASP,which is distinguished from the first hot wallet address of the secondVASP.
 7. The method of claim 6, wherein the first hot wallet address ofthe second VASP is one of the plurality of known wallet addresses of theVASPs.
 8. A computing device for identifying a wallet address associatedwith a virtual asset service provider comprising: a memory into which aprogram is loaded; and a processor that executes the program loaded intothe memory, wherein the program comprises: an instruction for obtaininga transaction of a virtual asset associated with the target walletaddress; an instruction for obtaining a list of a plurality of knownwallet addresses of virtual asset service providers (VASPs); aninstruction for identifying a type of the target wallet address based onthe transaction and the list of known wallet addresses of the VASPs; aninstruction for transmitting to the wallet address inquiry device, thetype of the target wallet address and the associated VASP information;an instruction for determining that a wallet information database or aservice provider information database does not have information on thetarget wallet address; and an instruction for adding the information onthe target wallet address and the type of the target wallet address tothe wallet information database or the service provider informationdatabase, based on a determination that the wallet information databaseor the service provider information database does not have theinformation on the target wallet address.
 9. The computing device ofclaim 8, wherein the instruction for obtaining a list of a plurality ofknown wallet addresses of virtual asset service providers (VASPs)comprises instruction for obtaining the list of a plurality of knownwallet addresses of virtual asset service providers (VASPs) from anon-transitory memory database of the wallet address identificationdevice, which collects and stores information regarding the plurality ofknown wallet addresses of VASPs.
 10. The computing device of claim 8,wherein the instruction for identifying comprises instruction foridentifying the type of the target wallet address, by performing atleast one of a cold wallet determination routine and a hot walletdetermination routine for the target wallet address.
 11. The computingdevice of claim 10, wherein the cold wallet determination routine, basedon a determination that the only sender address associated with thetransaction is the target wallet address, a receiver address associatedwith the transaction includes a hot wallet address of a first VASP, andthe transaction satisfies a first condition, determines that the targetwallet address is a cold wallet address of the first VASP.
 12. Thecomputing device of claim 11, wherein the hot wallet address of thefirst VASP is one of the plurality of known wallet addresses of theVASPs.
 13. The computing device of claim 10, wherein the hot walletdetermination routine, based on a determination that a sender addressassociated with the transaction includes both the target wallet addressand a first hot wallet address of a second VASP, determines that thetarget wallet address is a second hot wallet address of the second VASP,which is distinguished from the first hot wallet address of the secondVASP.
 14. The computing device of claim 13, wherein the first hot walletaddress of the second VASP is one of the plurality of known walletaddresses of the VASPs.